One word beat the guardrails: GitLost made GitHub's agent leak private repos
Researchers needed no credentials and no code. A public issue and the word 'additionally' were enough to walk private data out the door.
- Noma Labs disclosed GitLost, a critical prompt-injection flaw in GitHub's Agentic Workflows, with coverage landing July 7 and 8.
- An attacker needed no credentials and no access. Opening an issue in a public repo belonging to an org that uses Agentic Workflows was enough.
- The workflows typically run with read access to private org repos, and researchers slipped past GitHub's guardrails by prefixing the malicious instruction with the word "additionally."
- The proof of concept pulled a README out of a private repository and posted it publicly. No CVE has been assigned.
The flagship agentic feature of the world's biggest code platform just failed the oldest test in agent security: it did what a stranger's text told it to do. Researchers at Noma Labs disclosed a flaw they call GitLost in GitHub's Agentic Workflows, and the mechanics are uncomfortably simple. Anyone able to open an issue in a public repository, which is to say anyone, could plant instructions that the workflow's AI agent would execute with the org's own permissions.
How the attack worked
Agentic Workflows typically run with read access to both public and private repositories in an organization. Noma's researchers found that a malicious instruction buried in a public issue would be picked up by the agent as part of its working context. GitHub had guardrails against exactly this, and the researchers stepped around them with one word: prefixing the payload with "additionally," which made the model treat the attacker's instruction as a follow-on task from its legitimate assignment.
The proof of concept extracted the README from a private repository and posted it publicly. No credentials, no exploit code, no CVE. As Noma put it: "The agent's context window is also its attack surface."
The uncomfortable part for agent vendors
When a vendor sells an agent that acts with your credentials, the guardrails are not a feature of the product. They are the product. GitHub shipped guardrails, and a single adverb defeated them. That is the same lesson our coverage of the BeSafe benchmark keeps surfacing: task competence and rule-following are different capabilities, and the gap between them is where incidents live.
What buyers should do with this
Ask agent vendors three questions. What untrusted text can reach the agent's context. What credentials does the agent hold while reading it. And what happens when instructions in the data conflict with instructions from the operator. GitLost is what the wrong answers look like in production, at the platform that hosts most of the world's code.
Sources: Noma Labs disclosure, SecurityWeek, The Register, The Hacker News.